Colombia was one of the first countries in Latin America to regulate online gambling. The rules governing games operated over the internet were approved under Agreement No. 4 of 24 May 2016. A decade later, the market is no longer experimental.

According to figures presented by Senator Gustavo Moreno in an interview with Caracol Radio, bets worth 4.6 trillion Colombian pesos were placed in Colombia between January and March 2025 alone, across more than 8 million active accounts.

Players are also very young. 67% of people who gamble are aged between 18 and 29 and do so at least once a week. Other relevant figures show that more than 245,000 people have requested self-exclusion from authorised platforms.

These figures explain why the debate focuses on establishing who is behind each account. In late September 2026, three developments emerged within a few days of one another: a Senate proposal to strengthen digital identity checks for betting accounts, a responsible gambling bill in the House of Representatives, and news that Coljuegos is preparing a more stringent anti-money laundering framework. None of these initiatives is currently mandatory, but they show that the level of control in place is at the centre of the debate.

This brings us to the question operators ask us most often: how can we verify players’ identities in a way that meets today’s requirements and remains compliant tomorrow? In this article, we look at what is already mandatory and what is still under discussion, the identity verification methods available, and how to implement them while protecting personal data.

What is identity verification in online gambling, and why is it mandatory?

Identity verification is the process through which an operator confirms that a player is who they claim to be, is of legal age and is not prohibited from gambling. In Colombia, this is required under Coljuegos’ technical requirements.

In the industry, this process is known as KYC (Know Your Customer). Before allowing someone to deposit money, place a bet or collect a prize, the operator must have reasonable certainty that the person exists, is who they claim to be and is legally allowed to gamble. Establishing this requires answering three separate questions. First, is the document presented by the player authentic and valid? Second, is the person presenting it its legitimate holder? Third, can that person gamble, meaning are they of legal age, have they not self-excluded, and do they not appear on restricted lists?

It is important to distinguish this process from two related concepts. Age verification addresses only part of the third question: it confirms that the user is an adult, but not who they are. Authentication, by contrast, takes place after registration. It involves checking, at each login or withdrawal, that the person using the account is still its legitimate holder. An operator may carry out flawless identity verification during registration and still leave the door open if anyone can subsequently access the account using someone else’s password.

In Colombia, games of chance are administered by Coljuegos, a state-owned industrial and commercial enterprise. Online gambling operators operate under concession agreements with Coljuegos and must comply with its technical requirements, which include player registration and identification.

What risks does identity verification prevent for online gambling operators?

Robust verification helps protect against five main risks: underage gambling, identity theft, multiple accounts, money laundering and the return of self-excluded players.

The first risk is that of minors gambling with adults’ identity documents. A teenager using a parent’s or older sibling’s national identity card can get past any check based solely on date of birth because the document is genuine and the information is correct. Only a check that links the document to the person physically in front of the screen can significantly reduce this risk.

The market profile makes this risk particularly relevant. If, as reported by Caracol Radio, two out of every three players are aged between 18 and 29 and gamble every week, the most active group is only a few years removed from the legal gambling age. Consider a 16-year-old using the identity card of a 19-year-old sibling. The document is genuine, belongs to someone in their immediate circle and shows an age close to their own. A check based solely on the document’s data would not detect anything unusual.

There is also a harder-to-address scenario: a minor who does not register at all but instead uses an adult’s already verified account. In other words, they gamble through a third party. In this case, proper verification at registration is not enough. Identity must be checked again at certain high-risk moments, such as a withdrawal, a device change or an unusual gambling pattern.

Identity impersonation is the other side of the same problem. Someone opens an account using another person’s details or documents, for example, to move money that does not belong to them or collect prizes in someone else’s name. Multiple accounts occur when one person opens several accounts, for example, to claim a welcome bonus more than once or bypass the limits they have set for themselves. Identity deduplication can help detect when different records may belong to the same person and prevent these situations.

Money laundering explains why player identification is part of the anti-money laundering system (SARLAFT) that Coljuegos requires in the sector. A gambling account can be used to make money from illicit sources appear legitimate by depositing it and withdrawing it as if it were winnings. An operator cannot detect or report such transactions if the account holder has not been properly identified.

Finally, verification is what makes self-exclusion effective. According to Coljuegos, 245,199 people requested self-exclusion from authorised platforms between 2024 and 2025, and the block is applied using their identification number. If a player can register again under another identity or gamble through a third party’s account, the tool no longer works.

What regulations govern identity verification in online gambling in Colombia?

The current framework is based on Law 643 of 2001, as amended by Article 93 of Law 1753 of 2015, and is further defined by Coljuegos’ technical requirements, its responsible gambling resolution and Law 1581 of 2012 on personal data protection.

What are innovative games operated over the internet?

According to Coljuegos, innovative games include any form of games of chance other than traditional lotteries, fixed-odds betting and other games regulated by Law 643. Following the reform introduced by Law 1753 of 2015, this category includes all games operated over the internet, or through other information technologies that do not require the bettor to be physically present.

In these games, everything takes place through the player’s account, which is opened following prior registration. Deposits, bets, bonuses, winnings and withdrawals are all recorded in that account. This means that if the account holder’s identity is not properly verified from the outset, everything that happens afterwards becomes questionable, from the legality of a prize to the effectiveness of a deposit limit.

What information and documents are required during registration?

The technical requirements approved under Resolution 20224000026034 of 2022 oblige operators to collect the type and number of the identity document, its date and place of issue, the player’s full name and surname, date of birth, among other details. They must also collect the department and municipality of residence, identified using DANE codes, as well as the address, email address and telephone number. Operators must validate and update this information at least once a year.

As for accepted documents, the same resolution recognises the Colombian national identity card (cédula de ciudadanía), a valid foreigner’s identity card (cédula de extranjería) and, for Venezuelan nationals, the Special Permit to Stay (PEP) or the Temporary Protection Permit (PPT).

How is the legal gambling age verified?

The technical requirements oblige operators to establish mechanisms to verify players’ ages and prevent anyone who cannot prove they are of legal age from opening an account. However, they do not specify which mechanisms must be used. The choice of method is therefore left to the operator.

In our view, a merely formal check is not enough to meet this obligation. Checking that the date of birth on an authentic document corresponds to an adult provides little protection if no one verifies that the document belongs to the person registering. Facial biometrics with liveness detection, which compares the player’s face with the photograph on the document and confirms that a real person is in front of the camera, may therefore be a particularly suitable option. This link between the document and the person is precisely the problem highlighted by the initiatives currently under discussion.

What are the requirements for self-exclusion and gambling limits?

Resolution 20244000022654 of 2024 requires online operators to provide a visible, easy-to-use self-exclusion mechanism that allows players to choose exclusion periods in days, weeks or months. If a player later wishes to revoke that decision, the revocation takes effect 72 hours after the request is made. Operators must keep their self-exclusion register up to date and allow each player to set their own gambling limits. The entire system depends on the player’s identity being properly verified.

Who supervises compliance?

Supervision is shared between two authorities. Coljuegos oversees registration, identification and responsible gambling obligations arising from the concession. The Superintendence of Industry and Commerce (SIC), as the personal data protection authority, supervises how personal data is processed. The responsible gambling resolution also reminds operators that they must comply with Law 1581 and Decree 1377. In practice, an operator may comply with Coljuegos’ requirements and still risk a penalty from the SIC if it processes biometric data without appropriate safeguards.

What regulatory changes are being discussed?

There are four areas of ongoing discussion: a more stringent SARLAFT framework, digital identity measures to address underage gambling, reform of the data protection law, and age verification in digital environments. As of 5 October 2026, none of these proposals has been approved.

From onboarding to the player’s entire lifecycle: a more stringent SARLAFT framework

In late September, MundoVideo reported that Coljuegos is preparing a comprehensive SARLAFT framework (System for the Administration of Money Laundering, Terrorist Financing and Weapons Proliferation Risks) for land-based, innovative and promotional games, based on a risk-based approach. The text has not yet been published as a final resolution in the Official Gazette.

According to that report, the framework would require the identification of all online account holders and establish thresholds above which operators would have to apply enhanced identification measures: individual transactions from 96 UVT, monthly cumulative transactions from 287 UVT, and prizes from 96 UVT or 153 UVT in cumulative winnings. Based on the 2026 UVT value set by the DIAN at 52,374 pesos, these thresholds are approximately 5 million pesos per transaction, 15 million pesos per month and 8 million pesos in cumulative winnings. Operators would have 180 days from publication to adapt, and non-compliance could result in fines or even the termination of their concession.

The Senate proposal on digital identity and age verification

Congress is seeking to introduce much stricter regulation for online gambling, based on verifying the identity and age of bettors and strengthening digital identity. According to Focus Gaming News, the initiative would also include daily and monthly limits on deposits and losses.

The senator highlighted the problem of young people, including minors, gambling through third parties by using adults’ accounts or identity documents. The issue was also framed as a matter of mental health and the economy. This helps explain why identity verification is being linked to deposit and loss limits. A limit only protects the player if it is applied to the right person, and self-exclusion only works if the player cannot return using another identity or a third party’s account.

Age verification in the digital environment

Online gambling is not the only sector involved in this debate. Law 2489 of 2025, on safe and healthy digital environments for children and adolescents, has already been enacted. Its implementing decree has received criticism from organisations such as Karisma, Dejusticia and FLIP, which warn of the risk of excessive data collection for age verification. In July 2026, a further bill was introduced and is still under consideration. It seeks to restrict access to social media for under-16s through document validation or facial recognition. The balance between protecting minors and safeguarding privacy is therefore a debate that extends beyond the gambling sector.

What identity verification methods are available, and which is best?

In our view, only combining document verification with facial biometrics and liveness detection can reliably prevent a minor from gambling using an adult’s identity card.

Self-declared data provides very little security. Anyone can enter someone else’s identity card number. Document verification, which analyses an image of the document to detect counterfeits or alterations, is essential. However, it cannot detect when a genuine document is being used by someone other than its holder.

Facial biometrics with liveness detection addresses this gap. The player takes a selfie, the system compares it with the photograph on the document and, at the same time, checks that a genuine person is in front of the camera rather than a spoofing attack. This check is known as presentation attack detection.

Verification against the Registraduría’s biometric database compares the player with the State’s official records.

What should identity verification look like for online gambling in Colombia?

A robust process checks the document, the face and relevant lists during registration.

The process begins with document capture and validation. The player photographs their Colombian identity card, foreigner’s identity card or PPT, and the system extracts the data, checks the document’s security features and detects potential alterations. The date of birth is taken from the document rather than information typed in by the user, so age verification does not depend on the user’s honesty.

Next comes biometric verification: a selfie with liveness detection is matched against the photograph on the document, with the player’s prior authorisation. Once the identity has been confirmed, the operator cross-checks the data against the self-exclusion register and the lists required under the anti-money laundering framework, such as lists of politically exposed persons, known as PEPs under SARLAFT. These should not be confused with the immigration permit that shares the same acronym in Colombia. It is also advisable to detect potential duplicates to identify cases in which one person may be behind several accounts.

Registration, however, is only the beginning. If the new SARLAFT framework is approved, players will also have to be reverified when their transactions or winnings exceed certain thresholds. A well-designed process should be able to trigger these additional checks with minimal friction, for example, by requesting a new selfie rather than repeating the entire registration process.

Finally, every verification should leave an auditable record showing what was checked, when it was checked, the result and the technology used. This will allow the operator to demonstrate due diligence during a Coljuegos inspection or in response to a request from the SIC.

How can operators balance control with the player experience?

Controls that push players towards illegal websites do not protect anyone. Verification must be rigorous where risk is high and straightforward for the player.

Fecoljuegos’ warning about friction is well founded. Coljuegos issued 58,916 blocking orders against illegal gambling websites between 2022 and 2026, illustrating the scale of the illegal market. If verification is slow, confusing or frequently fails, some players may not abandon gambling altogether but instead leave the legal market, where safeguards are in place.

Control and user experience do not have to be incompatible, however. A mobile-first flow with automatic document capture and a selfie can provide a high level of security without becoming an obstacle. The risk-based approach that the new framework is expected to introduce would help in the same way: reserving additional checks for cases that warrant them makes it possible to maintain rigorous controls without penalising occasional players.

There are international examples of this approach. In the United Kingdom, the Gambling Commission has required online operators since 7 May 2019 to verify a customer’s name, address and date of birth before allowing them to gamble.

Why review the verification process now if nothing has been approved?

Because the proposed changes affect the core of KYC, the time available to adapt could be short if they are approved, and the underlying problem already exists.

There are three reasons not to wait. The first is the timeline. The second is that the risk driving the debate does not depend on new legislation: Law 643 already prohibits offering games of chance to minors, and the technical requirements already oblige operators to prevent them from opening accounts. The third is that the debate remains open: Coljuegos publishes its draft regulations for public comment before approval, giving operators and providers an opportunity to contribute their technical experience.

In practice, a good starting point is to assess the current process: how many registrations use biometrics and liveness detection, how long registration takes, how many players abandon the process, and what evidence is retained. This makes it possible to identify gaps against current regulations, anticipate additional gaps that the proposals could create, and review the processing of biometric data through a data protection impact assessment.

Frequently asked questions about identity verification for online gambling in Colombia

Is identity verification mandatory for online gambling in Colombia?

Yes, every player have to be registered and identified.

Will identity verification requirements for online gambling in Colombia change?

Changes are under discussion. There are proposals to strengthen digital identity and a more stringent SARLAFT framework, but nothing has been approved yet.

Can you gamble online in Colombia using a passport?

Passports are not included in the list. You can play with the Colombian national identity card, a valid foreigner’s identity card, and the PEP or PPT for Venezuelan nationals.